Production gateway

This guide covers the settings most production setups want, once Ceryx is deployed and serving your domains.

Enforce HTTPS everywhere#

Make every new route redirect plain HTTP to HTTPS by setting this environment variable when running docker compose up -d:

CERYX_ROUTE_SETTINGS_DEFAULT_ENFORCE_HTTPS=true

The default applies when a route is created and is stored with it. Update routes that already exist with their enforce_https setting.

Redirect www to your main domain#

A route in redirect mode sends visitors to its target with a permanent (301) redirect, keeping the path and query string:

docker compose -p ceryx exec ceryx curl -X POST localhost:8080/api/routes \
  -H 'Content-Type: application/json' \
  -d '{
    "source": "www.example.com",
    "target": "https://example.com",
    "settings": {"mode": "redirect", "enforce_https": true}
  }'

Now https://www.example.com/pricing?plan=team redirects to https://example.com/pricing?plan=team. The same pattern moves an old domain to a new one.

HTTP/2 and WebSockets#

Both work without any settings. Ceryx serves HTTPS over HTTP/2 when clients support it, and passes WebSocket upgrades through to your services.

Headers your services receive#

Ceryx forwards the original Host header, and adds:

Only trust these headers from Ceryx: keep your services off public ports, so every request reaches them through Ceryx.

Large uploads#

Ceryx accepts request bodies of up to 100 MB and answers 413 above that. Raise or lower the limit with CERYX_MAX_REQUEST_BODY_SIZE, for example CERYX_MAX_REQUEST_BODY_SIZE=1g.

Before you go live#

• Keep the API private. See Exposing the API safely.
• Test new domains against the Let's Encrypt staging environment first, to avoid hitting rate limits. See How certificates work.